Splunk Search

If column is certain value but the other is null.

Username1
Path Finder

Hi Everyone,

This might be straight forward and I'm missing it but my current query is below and I am not able to get the correct results, any thoughts? End goals is to get all with status of Done and a Resolution of blank. 

 

|  eval done_null = if(Status="Done" AND Resoloution!="*",Score,"0") 
              | stats sum(done_null) as Done_Null by time
              | table time, Done_Null

 

Labels (6)
0 Karma

to4kawa
Ultra Champion

Score is not number, I guess. check field extraction.

0 Karma

Username1
Path Finder

hi @to4kawa Score is another field in my data set. It comprises of numbers from 0-10

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults count=100
| eval time=strftime(_time,"%c")
| eval Score=random() % 11
| eval Status=mvindex(split("Done,Running",","),(random() % 3)), Resoloution=if(Score % 2 = 1,NULL,"High")

|  eval done_null = if(Status="Done" AND Resoloution!="*",Score,"0")
              | stats sum(done_null) as Done_Null by time
              | table time, Done_Null


check these feilds(time,Status,Resoloution)

0 Karma

Username1
Path Finder

@to4kawa So, I get that you created a random sample of numbers for my column Score and incorporated,  but then I got lost at your example using mvindex. So let's say that is Status is 'Done' and Resolution is blank, I want it to return a 1,  and then if not return a zero. How would you change this example to make it work properly. 

             | eval done_null = if(Status="Done" AND Resoloution!="*","1","0")
              | stats sum(done_null) as Done_Null by time
              | table time, Done_Null

 

0 Karma

to4kawa
Ultra Champion

As not working your query, some of your fields(time ,Score ,Resoloution) is wrong or nothing.

I don't know your whole query.  I can't see or resolve your problem.


Have you checked these?  try line by line? 

>  but then I got lost at your example using mvindex.

please see the command reference.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...